8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity
Inactive user accounts are removed or disabled within 90 days of inactivity.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The automated or scheduled process performing the check, and its execution records · Document repository
periodic reviewEvidence produced at each review
- Evidence accounts inactive for 90 days are removed or disabled, with the mechanism that enforces it · Identity provider / directory
- Exception records where an account is retained despite inactivity, with justification · Identity provider / directory
governing documentDocuments that govern the control
- User account listing with last logon information for all in scope system components · Policy repository / GRC workspace
- Handling of accounts where last logon is not recorded, so inactivity can still be determined · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Document repository on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Last logon not collected for some platforms, so inactivity cannot be measured and those accounts are skipped
- Service and application accounts exempted as a class rather than individually justified
- Check performed manually and missed during busy periods, so the 90 day limit slips
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.2.5 Access for terminated users is immediately revoked · 8.2.7 Third-party access managed